An efficient ECC-based mechanism for securing network coding-based P2P content distribution

Network coding has been demonstrated to be able to improve the performance of P2P content distribution. However, it is vulnerable to pollution attacks where malicious peers can flood the network with corrupted blocks easily, leading to substantial performance degradation. Moreover, existing corruption detection schemes for network coding are not well suited to P2P systems. Effective scheme to detect the corruption and identify the attacker is required to thwart such attacks. In this paper, we propose an efficient ECC-based mechanism for securing network coding-based P2P content distribution, namely ESNC, which includes an efficient network coding signature scheme and an identity-based malicious peer identification scheme. The two schemes cooperate to thwart pollution attacks on network coding effectively in P2P networks, not only detecting corrupted blocks on-the-fly efficiently, but also precisely identifying all the malicious peers quickly. ESNC is mainly based on elliptic curve cryptography (ECC) and can provide high level of security. It incurs significantly less computation and communication overheads than other comparable state-of-the-art schemes for P2P systems. ESNC can work with arbitrary topologies, as it is the case in P2P networks. Security analysis demonstrates that ESNC can resist hash collision attacks, signature forgery attacks, and collusion attacks with arbitrary number of colluding malicious peers. Simulation results show that ESNC effectively limits the corruption spread and identifies all the malicious peers in a short time under different practical settings.     

Detection and mitigation of localized attacks in a widely deployed P2P network

Several large scale P2P networks operating on the Internet are based on a Distributed Hash Table. These networks offer valuable services, but they all suffer from a critical issue allowing malicious nodes to be inserted in specific places on the DHT for undesirable purposes (monitoring, distributed denial of service, pollution, etc.). While several attacks and attack scenarios have been documented, few studies have measured the actual deployment of such attacks and none of the documented countermeasures have been tested for compatibility with an already deployed network. In this article, we focus on the KAD network. Based on large scale monitoring campaigns, we show that the world-wide deployed KAD network suffers large number of suspicious insertions around shared contents and we quantify them. To cope with these peers, we propose a new efficient protection algorithm based on analyzing the distribution of the peers’ ID found around an entry after a DHT lookup. We evaluate our solution and show that it detects the most efficient configurations of inserted peers with a very small false-negative rate, and that the countermeasures successfully filter almost all the suspicious peers. We demonstrate the direct applicability of our approach by implementing and testing our solution in real P2P networks.     

Stochastic Optimization for Content Sharing in P2P Systems

Available resources in peer-to-peer (P2P) systems depend strongly on resource contributions made by individual peers. Empirical data shows that in the absence of incentives, a majority of the participating peers do not contribute resources. Modeling interactions between individual peers is often difficult as the number of peers in the system can be very large, and the relationships among them can be very complex. In this paper, we propose a new solution for P2P systems, where peers upload and download content to and from the contributing peers based on agreed-upon/determined sharing rates. We propose a P2P solution that deters free-riders by imposing constraints on participating peers; specifically, a peer is allowed access to new content only as long as its own content contribution exceeds an adaptively set threshold. The constraints are enforced either by a central authority (e.g., a tracker) or by a decentralized coalition of peers in a swarm, social network, etc. We derive optimal upload policies for the peers given their estimated future download requirements and their previous contribution (credit) to the other peers. Our results show considerable improvement in the cost-benefit tradeoff for peers that deploy such an optimal policy as compared to heuristic upload policies. We also propose mechanisms based on which the coalition of peers can provide incentives or penalties to participating peers to adjust their policies such that the availability of content and/or number of peers contributing content is maximized.     

P2P网络中双向信任机制的研究

P2P网络(Peer toPeer,对等网)已经以飞快的速度发展成为internet中最重要的应用系统之一。P2P网络开放、匿名的特性使得任何人在任何时候都也可加入网络为其他人提供内容和服务,同时也可以从网络中查找并获得所需要的资源。然而,也正是因为这种特点,节点之间缺乏信任、恶意节点随意终止服务,造成了网络的利用率低下,信任管理就显得十分必要。然而传统的单向信任管理机制难以有效地对自私节点和恶意节点进行控制。鉴于此,本文在研究P2P网络的信任管理机制的基础上,引入了双向信任机制,实现节点之间的双向评估。     

两种门限签名方案在点对点电子商务中的应用

在JXTA协议基础上,针对基于松散一致结构化的点对点电子商务网络中,缺少可信中心和可能存在恶意节点的情况下,考虑对节点进行可信性分析是建立授权等服务的重要环节,提出在系统中应用RSA和DSA门限签名算法,以适应网络动态性强等特点的节点认证和访问控制方案,从而能够抵抗合谋等攻击,理论分析证明增强了系统安全性.模拟实验表明,门限方案提高了系统对节点识别的效率和认证的准确度,同时比较了门限RSA方案和门限DSA方案的运行效率.     

SimplyRep: A simple and effective reputation system to fight pollution in P2P live streaming

Peer-to-Peer (P2P) streaming has become a popular platform for transmitting live content. However, due to their increasing popularity, P2P live streaming systems may be the target of user opportunistic actions and malicious attacks, which may greatly reduce streaming rate or even stop it completely. In this article, we focus on a specific type of attack called content pollution, in which malicious peers tamper or forge media data, introducing fake content before uploading it to their partners in the overlay network. Specifically, we present a new decentralized reputation system, named SimplyRep, that quickly identifies and penalizes content polluters, while incurring in low overhead in terms of bandwidth consumption. We evaluate our method with both simulation and experiments in PlanetLab, comparing it against two previously proposed approaches, namely, a centralized black list and a distributed reputation system, in various scenarios. Our results indicate that SimplyRep greatly outperforms the two alternatives considered. In particular, both black list and the distributed reputation method perform poorly when polluters act jointly in a collusion attack, reaching a data retransmission overhead (triggered by polluted chunks received) of 70% and 30%, respectively, whereas the overhead experienced by SimplyRep is at most 2%. Our results also show that SimplyRep is able to quickly isolate almost all polluters under a dissimulation attack, being also somewhat robust to a whitewashing attack, although the latter remains a challenge to effective P2P streaming.     

P2P文件污染与防御

文件污染是P2P文件共享系统面临的主要安全威胁之一。由于没有中心机构监督用户行为及其共享的内容,恶意节点可以通过P2P传播病毒,木马等恶意内容,这些行为严重影响了P2P文件共享的系统性能。本文对P2P文件污染的研究现状进行综述,调查现有P2P系统中存在的文件污染现象及防御方法,分析了目前防御机制面临的问题。     

构造P2P环境下混合式信任模型

针对P2P网络中存在的安全性和可管理性较差、现有信任模型中信任度计算复杂等问题,提出了一种P2P环境下混合式信任模型。该模型采用混合式P2P网络结构,利用时间段机制计算节点信任度,有效地预防节点间的“夸大”、“诋毁”等行为;提出了模型的构建方法以及交互评价反馈方式。仿真结果表明该模型运算量小,并能够有效地孤立和识别恶意节点,具有较强的安全性能。     

一种节点信誉相关的P2P网络信任管理模型

现有的P2P系统中存在大量的欺诈行为和不可靠的服务.本文通过模拟社会关系网络中信任的形成机制,提出P2P网络信任管理模型TMMRN,TMMRN通过考察节点的信誉值来进行安全交易,节点的信誉主要来自于其他节点对它的加权信任反馈,在信誉计算中增加了激励机制.TMMRN还可减少交易时的网络负担.实验表明TMMRN可提高信誉值的计算效率,能有效抵抗恶意节点的攻击,还可激励懒惰节点主动参与到系统中来.     

Peer profile based trust model for P2P systems using genetic algorithm

The open and anonymous nature of P2P allows peers to easily share their data and other resources among multiple peers, but the absence of a defensible border raise serious security concerns for the users. There is a lack of accountability for the content that is shared by peers and it is hard to distinguish malicious users from honest peers. Establishing Trust relationship between peers can serve as the metric to determine the veracity of the shared content and reliability of the peers. Most of the research work in this area is on Reputation based trust management where trust is determined on the basis of recommendation of other peers. Such recommendations are subjective and can be biased. A number of peers can also collude to provide false testimony for malicious peers. This paper proposes a novel Trust model that combines peer profiling with anomaly detection technique. Each peer can establish trust based on its own prior activities with other peers by comparing the current activity of a peer with its historical data and Genetic Algorithm (GA) has been employed to detect the anomalous behavior. Peer profile is updated dynamically with every transaction using GA operator’s crossover and mutation. This model has been tested using a file sharing application against common attacks and the results obtained are compared with statistical anomaly detection approach.     

抵御P2P网络中团体欺骗的信誉机制

虽然传统的信誉机制可以有效激励P2P网络中的节点共享资源,但却带来女巫攻击和共谋攻击等安全问题,而现有的抵御这两种团体欺骗的方法往往没有考虑P2P网络的开放性,即鼓励节点的加入.本文从分析P2P信任网络(基于信任网络的P2P系统)的社团结构出发,根据节点之间的信任关系将网络划分成不同的信任团体,提出一种基于团体信任度的节点信誉机制.模拟实验结果表明:在不限制团体大小以及新节点加入的情况下,该机制可以有效地抵御开放P2P网络中的团体欺骗.     

Attack resilient P2P dissemination of RSS feed

RSS (really simple syndication) based feeds have become the defacto mechanism of web based publish subscribe. Peer-to-Peer delivery of such feeds can not only alleviate the load at the content server, but also reduce the dissemination latency. However, due to openness of P2P system, malicious peers can join the network as easily as normal peers do. Such malicious peers may pretend to relay but actually not, and thus deny service, or even disseminate counterfeit updates, rendering a Peer-to-Peer mechanism not only useless, but even harmful (e.g. by false updates). We propose overlay independent randomized strategies to mitigate these ill-effects of malicious peers at a marginal overhead, thus enjoying the benefits of Peer-to-Peer dissemination, along with the assurance of content integrity in RSS like web-based publish-subscribe applications without altering currently deployed server infrastructure. We conduct analysis of performance of our proposal by modeling behavior of the system and validating the same with simulation. Results show that our proposal is effective, robust and scalable.     

P2P文件共享系统中的分组信誉驱动机制

在P2P文件共享系统中,常会出现许多有策略的欺骗行为,而现有的信任模型并不能完全消除交易的风险。综合局部信任机制和全局信任机制,根据节点间相关的共享记录数据提出一种新的信誉计算方法,并进一步提出受信誉驱动的分组组织管理和节点搜索算法。仿真结果证明该信誉驱动机制能搜索到信誉值高的节点作为交易对象,并能有效降低系统面对合谋恶意节点和具有交易策略的恶意节点攻击时的交易风险。     

基于Super-node结构的P2P网络的信誉评价系统

针对基于Super-node结构的P2P网络提出了一个新的简单的信誉评价系统。该系统除了能根据其它对等点的反馈信息来建立对等点之间的信任关系外,还能帮助识别一些恶意对等点,从而保证整个P2P网络的正常运行。     

P2P文件共享系统中基于访问控制的信任模型

在P2P文件共享系统中,节点之间共享彼此的文件.但是由于对等网络的匿名性和开放性,在文件共享系统中存在很多信任方面的问题,如恶意节点和自私节点的大量存在.为了孤立恶意节点和鼓励节点共享自己的文件,提出了基于访问控制的信任模型.首先,定义了一种信任机制,它引入了直接信任,推荐信任,时间衰减等因子.其次,对每个共享文件都加入了两个阈值--可信性总评价阈值和贡献量阈值来控制访问.对于每个请求者,只有当它有了对文件的访问资格后才能访问该文件.最后,通过大量的实验证明了本模型的可行性和高效性,特别是对恶意节点具有很好的孤立作用.     

采用排名反馈的P2P名誉评价模型

P2P网络中的节点很可能从另外的节点那里收到质量很差的服务和信息,名誉评价是解决该问题的常见方法.基于评分反馈的P2P名誉计算机制存在下述缺点:无法区分恶意评价和诚实节点给出错误评价间的差别;需要对评分可信度进行二次评价,使名誉计算速度减慢;用数字来表示节点名誉的方式不够自然.实际上,名誉评价的用途是确定节点可信度的相...     

A security monitoring method for malicious P2P event detection

Recently malicious code is spreading rapidly due to the use of P2P(peer to peer) file sharing. The malicious code distributed mostly transformed the infected PC as a botnet for various attacks by attackers. This can take important information from the computer and cause a large-scale DDos attack. Therefore it is extremely important to detect and block the malicious code in early stage. However a centralized security monitoring system widely used today cannot detect a sharing file on a P2P network. In this paper, to compensate the defect, P2P file sharing events are obtained and the behavior is analyzed. Based on the analysis a malicious file detecting system is proposed and synchronized with a security monitoring system on a virtual machine. In application result, it has been detected such as botnet malware using P2P. It is improved by 12 % performance than existing security monitoring system. The proposed system can detect suspicious P2P sharing files that were not possible by an existing system. The characteristics can be applied for security monitoring to block and respond to the distribution of malicious code through P2P.     

Winnowing: Protecting P2P systems against pollution through cooperative index filtering

Pollution (i.e., sharing of corrupted files, or contaminating index information with bogus index records) is a de facto problem in many file sharing peer-to-peer (P2P) systems in use today. Pollution squanders network resources and frustrates users with unprofitable downloads (due to corrupted files) and unproductive download trials (due to bogus index records). In this paper, we propose a novel distributed hash table (DHT)-based anti-pollution scheme called winnowing. Winnowing aims to reduce or eliminate decoy index records (pointing to nonexisting or corrupted files) held by DHT (i.e., index) nodes in the system, so that download attempts based on the remaining (clean) index records are more likely to yield satisfactory results. To achieve this goal, two techniques are used: (1) publish verification is performed by index nodes to counteract index pollution and (2) privacy-preserving object reputation is integrated into the DHT to reduce the impact of content and metadata pollution. By integrating these techniques, winnowing converges quickly to a near-optimal solution. Winnowing has the added benefit that it does not reveal a peer's download history to other downloading peers.The publish verification of winnowing has been implemented on top of the latest eMule client, and extensive data has been collected from the Kad network using this modified client. The measurement results are summarized, and the findings from the measurement study are incorporated into an analytical model. The model demonstrates the robustness of the privacy-preserving object reputation of winnowing to a variety of pollution attacks, and to attacks on winnowing itself. The results of analysis are confirmed by means of event-driven simulations.     

内容中心网络中DoS攻击问题综述

“内容中心网络”（Content Centric Networking,CCN）是未来互联网架构体系群中极具前景的架构之一。尽管CCN网络的全新设计使其能够抵御目前网络存在的大多数形式DoS攻击,但仍引发了新型的DoS攻击,其中危害较大的两类攻击是兴趣包泛洪攻击和缓存污染攻击。这两类DoS攻击利用了CCN网络自身转发机制的安全逻辑漏洞,通过泛洪大量的恶意攻击包,耗尽网络资源,并导致网络瘫痪。与传统IP网络中DoS攻击相比,CCN网络中的内容路由、内嵌缓存和接收者驱动传输等新特征,对其DoS攻击的检测和防御方法都提出了新的挑战。本文首先介绍CCN网络的安全设计和如何对抗已有的DoS攻击,然后从多角度描述、比较CCN中新型DoS攻击的特点,重点阐述了兴趣包泛洪攻击和缓存污染攻击的分类、检测和防御方法,以及它们所面临的问题挑战,最后对全文进行总结。     

Multifactor hierarchical fuzzy trust evaluation on peer-to-peer networks

Decentralized Peer-to-Peer (P2P) networks offer not only opportunities but also threats. Due to the autonomy, self-interest and heterogeneousness of peers, the interaction outcomes are uncertain. One way to minimize the threats in such an open environment is exploiting the reputation method to evaluate the trustworthiness and predict the future behaviors of peers. While most of the existing reputation-based trust models focus on preventing network from the malicious peers, peers’ capabilities to fulfill the tasks are mostly ignored. In this paper, we present a novel trust model MHFTrust which quantifies and compares the trustworthiness of peers based on hierarchical fuzzy system. Six capability factors are identified to describe the peers’ trust on the capability, and one security factor, named “Malicious behavior” is used to evaluate the peers’ trust on security. Our trust model consisted of local-trust computation based on fuzzy techniques and global reputation aggregation, which integrates feedback from other peers to produce a global reputation for each peer. Credibility and weight of feedback are introduced to facilitate the computation of global reputation. It is shown in simulation that our trust model greatly improves the efficiency of P2P system, while the number of inauthentic files on the network is significantly decreased.